The obstruction of the Pitot probes by ice crystals during cruise was a phenomenon that was known but misunderstood by the aviation community at the time of the accident. From an operational perspective, the total loss of airspeed information that resulted from this was a failure that was classified in the safety model. After initial reactions that depend upon basic airmanship, it was expected that it would be rapidly diagnosed by pilots and managed where necessary by precautionary measures on the pitch attitude and the thrust, as indicated in the associated procedure.

The occurrence of the failure in the context of flight in cruise completely surprised the pilots of flight AF 447. The apparent difficulties with aeroplane handling at high altitude in turbulence led to excessive handling inputs in roll and a sharp nose-up input by the PF. The destabilisation that resulted from the climbing flight path and the evolution in the pitch attitude and vertical speed was added to the erroneous airspeed indications and ECAM messages, which did not help with the diagnosis.

The crew, progressively becoming de-structured, likely never understood that it was faced with a “simple” loss of three sources of airspeed information. In the minute that followed the autopilot disconnection, the failure of the attempts to understand the situation and the de-structuring of crew cooperation fed on each other until the total loss of cognitive control of the situation. The underlying behavioural hypotheses in classifying the loss of airspeed information as “major” were not validated in the context of this accident. Confirmation of this classification thus supposes additional work on operational feedback that would enable improvements, where required, in crew training, the ergonomics of information supplied to them and the design of procedures.

The aeroplane went into a sustained stall, signalled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood that they were stalling and consequently never applied a recovery manoeuvre. The combination of the ergonomics of the warning design, the conditions in which airline pilots are trained and exposed to stalls during their professional training and the process of recurrent training does not generate the expected behaviour in any acceptable reliable way.

In its current form, recognizing the stall warning, even associated with buffet, supposes that the crew accords a minimum level of “legitimacy” to it. This then supposes sufficient previous experience of stalls, a minimum of cognitive availability and understanding of the situation, knowledge of the aeroplane (and its protection modes) and its flight physics. An examination of the current training for airline pilots does not, in general, provide convincing indications of the building and maintenance of the associated skills.

More generally, the double failure of the planned procedural responses shows the limits of the current safety model. When crew action is expected, it is always supposed that they will be capable of initial control of the flight path and of a rapid diagnosis that will allow them to identify the correct entry in the dictionary of procedures. A crew can be faced with an unexpected situation leading to a momentary but profound loss of comprehension. If, in this case, the supposed capacity for initial mastery and then diagnosis is lost, the safety model is then in “common failure mode”. During this event, the initial inability to master the flight path also made it impossible to understand the situation and to access the planned solution.

Thus, the accident resulted from the following succession of events:

- Temporary inconsistency between the airspeed measurements, likely following the obstruction of the Pitot probes by ice crystals that, in particular, caused the autopilot disconnection and the reconfiguration to alternate law;

- Inappropriate control inputs that destabilized the flight path;

- The lack of any link by the crew between the loss of indicated speeds called out and the appropriate procedure;

- The late identification by the PNF of the deviation from the flight path and the insufficient correction applied by the PF;

- The crew not identifying the approach to stall, their lack of immediate response and the exit from the flight envelope;

- The crew’s failure to diagnose the stall situation and consequently a lack of inputs that would have made it possible to recover from it.

These events can be explained by a combination of the following factors:

- The feedback mechanisms on the part of all those involved that made it impossible:-- To identify the repeated non-application of the loss of airspeed information procedure and to remedy this,-- To ensure that the risk model for crews in cruise included icing of the Pitot probes and its consequences;

- The absence of any training, at high altitude, in manual aeroplane handling and in the procedure for ”Vol avec IAS douteuse”;

- Task-sharing that was weakened by:-- Incomprehension of the situation when the autopilot disconnection occurred, -- Poor management of the startle effect that generated a highly charged emotional factor for the two copilots;

- The lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers;

- The crew not taking into account the stall warning, which could have been due to:-- A failure to identify the aural warning, due to low exposure time in training to stall phenomena, stall warnings and buffet,-- The appearance at the beginning of the event of transient warnings that could be considered as spurious,-- The absence of any visual information to confirm the approach-to-stall after the loss of the limit speeds,-- The possible confusion with an overspeed situation in which buffet is also considered as a symptom,-- Flight Director indications that may led the crew to believe that their actions were appropriate, even though they were not,-- The difficulty in recognizing and understanding the implications of a reconfiguration in alternate law with no angle of attack protection.

The BEA analysed that the captain appeared unconcerned with regards to the weather ahead as indicated by weather radar ahead at the Intertropical Convergence Zone (ITCZ) and unresponsive to the concerns expressed by the first officer, pilot flying. The BEA said: "He favoured waiting and responding to any turbulence noticed. He vaguely rejected the PF’s suggestion to climb, by mentioning that if “we don’t get out of it at three six, it might be bad”. He certainly meant that if the aeroplane was still in turbulent conditions at FL360, the margins for manoeuvre would be further reduced." and reiterated: "The Captain neither expressed nor explained his position clearly. He seemed to have good experience of the ITCZ, and did not appear personally worried (at worst he expected to be disturbed by the turbulence during his rest). He noticed the turbulence and observed the St. Elmo’s fire. But it seemed that having seen the information available on the radar, he deemed the appearance of the ITCZ crossing to be “normal”. As we do not have the radar image which was provided by his ND, it is difficult to assess the Captain’s appraisal. But the aeroplane had not encountered, before or during the accident, an exceptional meteorological situation from the point of view of phenomena that are traditionally avoided in stormy environments (turbulence, lightning, icing)."

The BEA analysed as result that the radar image probably was not alarming.

The BEA analysed that the time of the captain taking his rest "could be contested, without necessarily calling into question the principle of a relief co-pilot and the trust that this implied in the co-pilots." The choice however was understandable given the ITCZ appeared normal and the second first officer was three times more experienced than the captain. Nonetheless, delaying the rest until the ITCZ would have been crossed would have delayed the rest by only 15 minutes.

The captain did not formally assign the roles to the two first officers. Usually the relief pilot would assume the role of the commander during the absence of the commander from the cockpit. However he did implicitely assign the role of the commander to the first officer in the right hand seat, this distribution of roles containing no ambiguity for the two first officers. This choice however was not free of difficulty: "Indeed, the overall experience and on type of the PF, designated implicitly as relief Captain, was significantly less than that of the PNF, also OCC executive of the airline and as such enjoying recognition as an expert by his peers." The pilot monitoring however then exercised natural authority by recommending, actually asserting, an avoidance strategy for the ITCZ which the pilot flying, relief captain, did not resist to.

The BEA analysed: "Without this leading to the slightest conflict, after the autopilot disconnection, it rapidly led to the inversion of the normal hierarchical structure in the cockpit, with leadership passing to the PNF in the left seat without the role of command being formally and explicitly transferred."

The aircraft subsequently encountered light to moderate turbulence with the autopilot countering the turbulence, the autothrust made a slight reduction of thrust to adjust the cruise mach towards the selected 0.8 mach. A first disturbance in speed caused the autopilot to disconnect with associated aural warning, the speed disturbance probably not noticed by the crew. The crew reacted by reflex with the pilot flying announcing "I have control" and the pilot monitoring acknowledging.

3 seconds later the right hand primary flight display the speed indication dropped from the right hand primary flight display for 5 seconds associated with a drop of altitude by 330 feet, a second later the left hand speed indication became abnormal.

The magnitude of the speed anomaly was "not salient" compared with the autopilot disconnection the crew did not detect a problem with the airspeed indications but with the autopilot disconnection.

No announcements were made with regards to the fly by wire degradation to alternate law and the disconnection of the autothrust system.

The BEA analysed: "For the same reasons relating to salience, it is likely that the crew had not yet perceived the reconfigration to alternate law and the disconnection of the A/THR. It was thus the autopilot disconnection that made the crew aware that there was a problem. The crew, at this time, did not know why the AP had disconnected and the new situation that had suddenly arisen clearly surprised the pilots – a normal reaction for any crew. This degree of surprise can be explained by the contrast between the triggering of a warning and the situation in the cruise phase, during which the pace of change tends to be slow and concentration levels are lower. In addition, the crew’s mental resources were already taken up by turbulence avoidance manoeuvres and the plan to climb during the minutes that preceded the autopilot disconnection. Associated with the environmental conditions (smell of ozone that the PF did not seem to recognise and the noise due to the ice crystals), the PF’s attitude in the minutes that preceded the autopilot disconnection probably constituted a factor that significantly added to the highly charged emotional factors during the sudden and unexpected change in the situation, at night and while passing through the ITCZ, which suddenly confirmed his vague concerns about it. Three seconds after the autopilot disconnection, surprise was a pilot’s natural reaction and cannot be considered as specific to this crew."

The BEA continued analysis: Immediately after detecting the problem an action plan should been developed before taking action. However, after the autopilot disengaged the aircraft rolled from 0 to +8.4 degrees in two seconds without any inputs on the sidestick. The PF was thus immediately absorbed by dealing with the roll.

In addition the PF made abrupt and excessive stick inputs to increase the pitch angle. The BEA analysed: "This nose-up input may initially have been a response to the perception of the aeroplane’s movements (in particular the reduction in pitch angle of 2° associated with the variation in load factor) just before the AP disconnection in turbulence. This response may have been associated with a desire to regain cruise level: the PF may have detected on his PFD the loss of altitude of about 300 ft and loss of vertical speed of the order of 600 ft/min in descent." and continues the abrupt and excessive nature of the input is probably to be explained by the startle effect and emotional shock at the autopilot disconnection "amplified by the lack of practical training for crews in flight at high altitude, together with unusual flight control laws."

The altitude alert (c-chord) began to sound and continued to sound.

The prolonged nature of the nose up inputs however find no explanation, the pilot flying did not verbalize his intentions and the pilot monitoring did not call the pitch angle. It was also not possible to determine what the purpose of the pitch stick input was.

4 seconds after the autopilot disconnected a first stall warning activated due to the rapid increase of the pitch angle and vertical acceleration of the aircraft. The BEA analysed: "it is clear that almost all the crews that heard the stall warning considered it to be surprising and irrelevant. These judgements may be explained by the lack of awareness of the margins in relation to the trigger threshold of the stall warning and by not knowing the triggering conditions of the warning, which are a function of the angle of attack and Mach."

The BEA continued: "It would also seem unlikely that the PNF could have determined the PF’s flight path stabilisation targets. It is worth noting that the inputs applied to a sidestick by one pilot cannot be observed easily by the other one and that the conditions of a night flight in IMC make it more difficult to monitor aeroplane attitudes (pitch attitude in particular). In addition, a short time after the autopilot disconnection, the PF’s statement that he had the controls and his reaction to the initial deviations observed (in particular in roll) may have led the PNF to change his action priorities. Identification of the failure appeared to become a priority over control and flight path monitoring. Consequently, he was unaware of the climb."

3 seconds after the autopilot disconnection the ECAM had no information displayed that would suggest any problem with the indicated airspeeds adding to the confusion, instead the ECAM displayed indication that a maximum speed of 0.82 mach is not to be exceeded (but not stating a minimum speed). "This could lead crews to suppose that the main risk is overspeed. In the absence of any reliable speed indication, this might lead to a protective nose-up input that is more or less instinctive."

About 10 seconds after the autopilot disconnection the crew had built a mental picture of the situation having identified a speed anomaly, however, the crew did not mention how many speed sources they had identified failed. The loss of airspeed indication was almost simultaneously called out by both pilots.

A number of ECAM messages appeared, which "provided no apparent assistance to the crew". The messages identifying different issues did not permit to identify the source of the problems but directed attention in all different directions and were rather confusing than helpful in identifying the problem(s) at hand.

The flight director had been removed from the primary flight displays and now re-appeared with the mode "vertical speed" commanding nose down inputs, the PF inputs were consistent with those flight director indications.

"The PNF detected the climb based on observation and reasoning (“according to all three you’re climbing”), which indicates the beginning of a loss of confidence in the instrument readings. In particular, he asked the PF to stabilise, to pay attention to the airspeed and to descend. His instructions were imprecise insofar as they did not give the PF a firm objective (e.g. maintain altitude or adopt a specific pitch attitude); however, they do appear to have been essential and sufficient for a short-term management of the situation."

The pitch attitude had exceeded 10 degrees nose up, the flight director indications and the PMs calls resulted in the pitch attitude reducing, the aircraft however was still climbing. The flight director began to indicate nose up resulting in the nose down inputs reducing. The PF reduced thrust.

"The PNF had noticed the need to stabilise the flight path, and the need for moderate aeroplane handling inputs. He probably considered that the reduction in pitch and the vertical acceleration sensed was a sufficient sign that the PF would correct the flight path to allow him to devote himself once again to identifying the failure."

The right hand air data #2 were at the verge of becoming reliable again when the pilot monitoring, attempting to resolve the situation, unilaterally decided to switch the air data source to #3 and thus unintentionally prevented the right hand primary flight display air data from becoming valid again.

The c-chord warning was still sounding and had saturated the aural environment in the cockpit which "certainly played a role in altering the crew’s response to the situation". 42 seconds after the autopilot disconnected one of the crew pushed the master caution button, probably due to the fact it had been illuminated since the first stall warning, the c-chord ceased.

The flight director bars re-appeared in vertical speed mode commanding a climb rate of 1400 feet per minute. The mode was never called by the crew. The bars indicated a slight nose up required.

46 seconds after the autopilot disengaged a second stall warning activated consisting of a synthetic voice calling "Stall! Stall!" and a cricket. In addition a visual display of a red and black strip at the speed tape on the primary flight display would normally occur except when the calculation of the stall warning speed was no longer possible, in which case no visual indication would occur.

"The aural characteristics of the warning (a synthetic voice saying “Stall, stall” and the cricket), or the “deterrent buffet” vibrations, are thought to be so intrusive that they will make the crew realise that their understanding of the situation is mistaken, and will call their attention to the fact that the aeroplane is approaching the limits of the flight envelope."

The aircraft still continued to climb with the stick inputs still commanding a nose up when only a nose down input could have brought the aircraft back within the flying envelope. The kinetic energy of the aircraft was converted into potential energy causing a rapid speed reduction, which increase the angle of attack, the resulting drag of the high angle of attack exceeded the thrust available from the engines so that the aircraft could no longer accelerate by thrust from the engines. Inevitably the aircraft began to descend, stick inputs still commanded nose up and the angle of attack increased further as result.

"Subsequently, the position of the sidestick, maintained in its nose-up or neutral position, continued to exacerbate the situation and made the recovery uncertain, even impossible."

The BEA analysed: "The crew never referred either to the stall warning or the buffet that they had likely felt. This prompts the question of whether the two co-pilots were aware that the aeroplane was in a stall situation. In fact the situation, with a high workload and multiple visual prompts, corresponds to a threshold in terms of being able to take into account an unusual aural warning. In an aural environment that was already saturated by the C-chord warning, the possibility that the crew did not identify the stall warning cannot be ruled out. ... Finally, although the PNF had called out the reconfiguration to alternate law when reading the ECAM, and even though the indicators of the loss of protection should have been displayed on the PFD (SPD LIM and an amber cross in roll and yaw), it is possible that the PF was not fully aware of this reconfiguration and of what it implied. He may therefore have embraced the common belief that the aeroplane could not stall, and in this context a stall warning was inconsistent."

When the captain returned to the cockpit he had certainly heard the stall warning and noticed the vibrations linked to buffet and the pitch attitude of 15 degrees, however made no reference to this. The aircraft was in a rapid descent close to the originally assigned altitude at that point. The stall warning became intermittent and interwoven with the altitude alert (c-chord). Both warnings combined created a saturated aural environment. The captain had difficulty to understand what the first officers were saying and while trying to read the instruments, faced with the description the first officers had lost control and had tried everything without a more precise decription of the sequence of events, he would have needed to query the first officers about the sequence of events, which was however impossible due the urgency of the situation and the stress conveyed by the first officers, he had difficulty to diagnose the situation. His interventions made clear that he too had not understood the aircraft was stalling.

Descending through FL315 the angle of attack had stabilized around 40 degrees nose up. "Only an extremely purposeful crew with a good comprehension of the situation could have carried out a manoeuvre that would have made it possible to perhaps recover control of the aeroplane. In fact, the crew had almost completely lost control of the situation."

The BEA analysed with regards to pilot training and flight simulator "demonstrations" of stall during their initial training for the type rating, that those two opportunities to learn about an approach to stall with fly by wire at normal and alternate law were conducted at low altitude (FL100). "At high altitude, the margin between the normal angle of attack in cruise and the angle of attack that activates the stall warning is very small. Trainees who perform the exercise at low altitude note a reduction in speed compared with the reference values but are not sensitized to the proximity of the angle-of-attack threshold at which the warning is triggered. The demonstrative nature of the exercises undertaken does not enable the crew to appreciate the startle effect generated by the stall warning, nor the reflex actions on the controls that may be induced."

The BEA goes on to condemn training philosophies in their analysis: "Current training practices do not fill the gap left by the non-existence of manual flying at high altitude, or the lack of experience on conventional aeroplanes. Furthermore, they limit the pilots’ abilities to acquire or maintain basic airmanship skills."

The BEA analysed that usually airliners are designed to provide for a positive longitudinal static stability meaning, the aircraft would return to its point of equilibrium (trim) with the controls neutral. This however is not true for the A330 which has a neutral longitudinal static stability meaning, that in alternate law with the aircraft approaching to stall neutral stick inputs would not prevent the aircraft from stalling demanding active nose down inputs for recovery.

The BEA continues: "When there are no protections left, the aeroplane no longer possesses positive longitudinal static stability even on approach to stall. This absence specifically results in the fact that it is not necessary to make or increase a nose-up input to compensate for a loss of speed while maintaining aeroplane altitude. This behaviour, even if it may appear contrary to some provisions in the basic regulations, was judged to be acceptable by the certification authorities by taking into account special conditions and interpretation material. Indeed, the presence of flight envelope protections makes neutral longitudinal static stability acceptable."

The flight directors, other than the autoflight systems which disconnected automatically, did not disconnect, but were removed from display. The unreliable airspeed procedures require the flight directors to be disengaged with the intention to avoid conflicting and false flight director indications. With the flight directors not being disengaged, the display of the flight directors would resume as soon as the operating conditions were regained.

This behaviour of the flight directors probably played a role into the accident as combination of following factors:"- credibility of the cross bars is strengthened by their disappearance followed by their re-appearance: if they appear, it implies that the indications that they display are valid;- Since they attract the crew’s attention (green colour and presentation in the centre of the PFD), the presence of the cross bars could have influenced the actions of the PF, notably in respect to his reaction to the stall warning;-ˆ It is only possible to be aware of the changes in active modes (when the cross bars reappear) by reading the FMA, which is probably difficult to do in a high workload situation induced by piloting or failure management tasks."

The BEA reported that stall warnings are a frequent occurrence in zones of turbulence and thus led crews to discard the stall warnings as "spurious" (nuisance). "For this reason, the behaviour of the AF 447’s crew should be considered as liable to be reproduced as regards the lack of reaction to the first STALL warning."

In addition, the flight crew manual released by the aircraft manufacturer states that a stall warning in alternate or direct law is identified by the combination of the aural warning, the illumination of the master caution AND the red and black stripe on the airspeed tape. The FCOM makes no mention of buffeting and does not take into account the loss of computation of the stall warning speed, which prevents the display of the red and black stripe. In the absence of the stall warning speed only the aural warning is therefore unambiguous.

Thus the BEA analysed: "The salience of an aural warning not reiterated visually in symbolic form, on a very “visual” aeroplane, is doubtless insufficient. However, irrespective of the ergonomics of the warning, it is likely that the presentation of information that provides an overview of the aeroplane’s situation (angle of attack, energy balance (kinetic and potential), flight envelope) would help pilots to “make sense” of the warning and to take the appropriate corrective action in time."